Stored XSS in October CMS SVG Upload Enables Privilege Escalation

Executive Summary

This vulnerability exists in the October CMS platform versions prior to 3.7.14 and 4.1.10. It is a stored cross-site scripting (XSS) issue related to the SVG sanitization logic. The system uses a regex pattern to remove event handler attributes like onclick or onload from SVG files, but this pattern can be bypassed with a specially crafted payload. This allows malicious SVG files containing embedded JavaScript to be uploaded via the Media Manager.

For the exploit to succeed, an attacker must have authenticated backend access with media upload permissions. The malicious SVG must then be viewed or embedded in a page by a superuser, which can lead to privilege escalation.

The issue was fixed in versions 3.7.14 and 4.1.10 of October CMS.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can allow an attacker with authenticated backend access and media upload permissions to upload malicious SVG files containing JavaScript. When a superuser views or embeds these SVG files, the embedded script can execute, potentially leading to privilege escalation.

This means an attacker could gain higher privileges than intended, possibly compromising the security and integrity of the CMS and its data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade October CMS to version 3.7.14 or 4.1.10 or later, where the stored cross-site scripting (XSS) issue in the SVG sanitization logic has been fixed.

Additionally, restrict authenticated backend access with media upload permissions to trusted users only, as exploitation requires such access.

Avoid viewing or embedding untrusted SVG files in pages until the system is updated.

Useful 0 Not Useful 0